I see that there is an option of dns under "crypto ikev2 authorization policy"
(config-ikev2-author-policy)#?
IKEv2 authorization policy commands:
aaa Specify aaa attribute list
backup-gateway Specify backup gateway
banner Specify mode config banner
configuration Push configuration to the client
def-domain Set default domain name to send to client
dhcp Specify DHCP server for config address assignment
dns Specify DNS Addresses
...
I also found reference here: https://www.cisco.com/en/US/docs/ios-xml/ios/sec_conn_ikevpn/configuration/15-1mt/Configuring_Internet_Key_Exchange_Version_2.html
Which it says "Specifies the primary and secondary Domain Name Service (DNS) servers that is sent to the client in the configuration reply."
I also see on the client, the output is showing the configured DNS:
Local req msg id: 9 Remote req msg id: 0
Local next msg id: 9 Remote next msg id: 0
Local req queued: 9 Remote req queued: 0
Local window: 5 Remote window: 5
DPD configured for 55 seconds, retry 2
Fragmentation not configured.
Dynamic Route Update: disabled
Extended Authentication not configured.
NAT-T is detected inside
Cisco Trust Security SGT is disabled
Initiator of SA : Yes
Pushed IP address: 172.16.10.74
DNS Primary: 4.2.2.2
Remote subnets:
172.16.4.1 255.255.255.255
192.168.100.0 255.255.255.0
10.8.0.0 255.255.0.0
0.0.0.0 0.0.0.0
However, it is not present in DNS view
#show ip dns view
DNS View default parameters:
Logging is off
DNS Resolver settings:
Domain lookup is enabled
Default domain name: cisco.com
Domain search list:
Lookup timeout: 3 seconds
Lookup retries: 2
Domain name-servers:
192.168.1.254
DNS Server settings:
Forwarding of queries is enabled
Forwarder timeout: 3 seconds
Forwarder retries: 2
Forwarder addresses:
What I want is when site-to-site VPN is established, I want to make sure the DNS request is sent to my Head End Router via the VPN tunnel instead of using the client's default (which may become inaccessible after VPN is up). But it doesn't seem like the "dns" option is doing anything.
